6 ms·

These guys are essentially more black hat than white hat

by hdyr 9y ago

dsacco 9y ago
No they aren't. Aside from the inherent and obvious lack of nuance in that terminology, black hats do not report their vulnerabilities. They weaponize them and use them, or they sell them to criminal organizations.
- Sir_Cmpwn 9y ago
  Black hat isn't distinguished by failing to report vunlerabilities. It's distinguished by bad faith.
  - dsacco 9y ago
    No, it's actually not. It's distinguished precisely by using a vulnerability with the intention to compromise others. You can't just redefine "black hat" to be whatever normative disagreement you have with how people choose to disclose vulnerabilities. That's entirely subjective.
    - robrenaud 9y ago
      This is what wikipedia says: A black hat hacker (or black-hat hacker) is a hacker who "violates computer security for little reason beyond maliciousness or for personal gain" The personal gain part certainly fits with short selling the stock.
      - dsacco 9y ago
        Excellent, great citation! Now, precisely what did the security researchers hack for their own gain, and precisely which computer's security was violated? If we can call them "hackers" just because they ostensibly compromised their own hardware or software as a proof of concept for the vulnerability research, does that mean that all of Google's Project Zero consists of hackers and black hats because they get paid (personal gain) by Google to find security vulnerabilities?
        Sir_Cmpwn 9y ago
        Project Zero practices responsible disclosure. They do not make money from the exploitation of the companies whose software/hardware they find flaws in. The difference is very stark and you are being deliberately obtuse.
        dsacco 9y ago
        > They do not make money from the exploitation of the companies whose software/hardware they find flaws in. Right, and neither did these researchers. In point of fact, no, the difference really isn't all that stark. It's a difference of degree, not category. You apparently have a problem with disclosing vulnerabilities without providing advanced notice to the vendor, and you consider it especially distasteful to do so if you're financially benefitting from that. But all of that still comprises vulnerability disclosure, which is categorically different from actively using a vulnerability to compromise users as part of a criminal enterprise. We can go back and forth like this all day, because every time someone bends the definition of black hat to fit something they disagree with, I can form a counterpoint which is technically true but which no one is willing to call black hat behavior, like Google Project Zero. On the other hand, if we use the definition of black hats as criminals engaging in online fraud, augmented by security vulnerabilities, then of course Google Project Zero doesn't qualify. You're going to have a very difficult time broadening the scope of this terminology to suit your definition without accidentally including groups you don't want to be in the same bucket. And that's precisely my point. If you broaden terms too much, like "black hat" to "stuff with computers in bad faith", we can just weasel in whatever satisfies the definition or agrees with our personal viewpoint. Black hat criminals do not engage in debatable behavior, because it's strictly illegal and directly profits at the expense of other people. At best, all you can do is formulate an abstract argument about people being harmed by rapid disclosure, but that actually comes down to a debate of disclosure guidelines, not a debate of activist investing.
        Sir_Cmpwn 9y ago
        >Right, and neither did these researchers. I'm just going to conclude that you are trolling at this point and try to forget this headache of a thread.
    - Sir_Cmpwn 9y ago
      No one defined "black hat". Just what authority do you think sets that? There is none. Black hat is not a standard to which people are scrutinized.
      - dsacco 9y ago
        There is a reasonably accepted definition for what a "black hat" is. I don't particularly agree with conceptually bucketing people into black hats or white hats, but the paradigm has an existing meaning. In any case, if we go by what you're saying, then anyone can define "black hat" to mean whatever they want, which means it's a meaningless and unproductive concept to throw around in conversation. Your assertion is in a catch-22 here. Words have meaning without requiring an independent body to rigorously define them. The established definition of a black hat is someone who compromises other people using security failures for their own gain. If instead we choose to say that the term has no established definition, then the entire point is moot, because calling someone a "black hat" no longer means anything.
        Sir_Cmpwn 9y ago
        There is a "reasonably accepted" definition of black hat, by your reasoning, and it is: someone who uses computers in bad faith.
        dsacco 9y ago
        > There is a "reasonably accepted" definition of black hat, by your reasoning, and it is: someone who uses computers in bad faith. Speaking as someone who 1) works in the security industry, 2) has managed corporate disclosure programs as an internal security engineer, 3) has run a security consulting firm working with many companies, and 4) has reported security vulnerabilities in disclosure programs; no, that's not the reasonably accepted definition. I can't think of any colleague I've ever worked with off the top of my head, nor any widely read security-focused periodical (like Krebs), who would use the term "black hat" for such a generalized disagreement of ethics.
        9y ago
- lallysingh 9y ago
  I think some here believe that the weapon here is financial; to trade the stock.
  - dsacco 9y ago
    I'm sure they believe that, but to be blunt, that changes the definition of "black hat" from "compromising people with security vulnerabilities" to "doing things I personally find unsavory when publicly disclosing security vulnerabilities." If people want to bend over backwards to make an argument about the abstract way in which people are harmed by small disclosure windows, activist investing or information asymmetry in the market, they're free to do so. But none of those things qualifies as black hat behavior. Definitions require precision to be useful, and you throw all precision out the window if you decide to lump people with disclosure habits you dislike in with organized criminals stealing identities en masse.
- hdyr 9y ago
  If the term is flexible, why the hard reaction to my flexing of it? I agree with the sibling commenters here. This is a bad faith, financially-motivated disclosure with insufficient time given to AMD to react
  - dsacco 9y ago
    > If the term is flexible, why the hard reaction to my flexing of it? The terminology is not flexible, it has a well established meaning. If your bar for a black hat includes legitimate security researchers disclosing vulnerabilities in a way you don't like, you've just expanded the group of people we can call "black hats" almost arbitrarily. You're putting security researchers you have a normative disagreement with into the same group of people who commit actual fraud, steal identities and sell your credit card data.
- cat199 9y ago
  black hats use them for bad, white hats use them for good. ideological discussions about disclosure policy aside, if they are doing this to manipulate stock prices and in doing so create a situation where more actual exploits occur, I'd say that is 'black hat' behavior.. the 'weaponization' is in the 'social engineering' of the market reaction, rather than a direct exploit in this case..
  - dsacco 9y ago
    The problem with your first line is that it leaves the definition of black hat open to interpretation, when that is not how the word is actually used in the security industry or in popular reporting. Black hat activity specifically refers to criminal activity, which we can demonstrably perceive and attribute. By your reasoning, I am free to call security researchers black hats if they don't give vendors advance notice. You might disagree with that, but you can't say I'm wrong without making a normative argument about whether or not something is ultimately unethical. There is no categorical difference between me choosing to call people black hats if I disagree with their behavior and you calling these researchers black hats because they're doubling as activist investors. On the other hand, this entire sideshow is bypassed if we use the well-established definition for "black hat", which refers exclusively to illegal behavior involving security vulnerabilities and online fraud. More to the point, reporting facts is not "market manipulation" (which is also a well established term) even if you want it to be, and "social engineering" is not the same as publicizing information with the intent to move the markets. Using these words in the way you are is the same as flippantly redefining them as you go along, with the result that the conclusion is quite brittle. There could be a strong argument that the behavior is unethical, but using these terms as you are doesn't help that point along, it hampers it.
    - cat199 9y ago
      > Black hat activity specifically refers to criminal activity, which we can demonstrably perceive and attribute stock manipulation is clearly criminal, if you want to take the 'letter of the law' approach.. beyond this, this gets into the same debate as letter of the law vs spirit of the law, which has both nothing and everything to do with this topic.. black hat is not 'defined exclusively' anywhere, and of course one leaning to a 'letter of the law' argument would then also look for 'exclusive definitions' as to your point: > free to call security researchers black hats if they don't give vendors advance notice. if they are doing this for malicious purposes, yes if it is for an ideological stance, then, well, it depends on how you view their ideology. what happens if the law is incorrect? again, letter of the law vs spirit of the law. "normative argument about whether or not something is ultimately unethical" laws are normative arguments about whether or not something is ultimately unethical.. not neutral 'things' that exist in a vacuum. and they can be correct or incorrect, and also incompletely defined.. how does acting completely unethically yet entirely within the law for malicious purposes fit into your framework? Say for example, actively portscanning (legality nebulous) for already infected computers and then overcharging 2000% for cleanup? Then spamming virii from a jurisdiction where it is not illegal in order to grow this 'business'? All legal.. so it's "white hat?" or is it 'grey hat' because it is in a legal 'gray area'? I don't think that's what grey hat means either..

These guys are essentially more black hat than white hat

by hdyr 9y ago

These guys are essentially more black hat than white hat

No they aren't. Aside from the inherent and obvious lack of nuance in that terminology, black hats do not report their vulnerabilities. They weaponize them and use them, or they sell them to criminal organizations.

Sir_Cmpwn 9y ago
Black hat isn't distinguished by failing to report vunlerabilities. It's distinguished by bad faith.
- dsacco 9y ago
  No, it's actually not. It's distinguished precisely by using a vulnerability with the intention to compromise others. You can't just redefine "black hat" to be whatever normative disagreement you have with how people choose to disclose vulnerabilities. That's entirely subjective.
  - robrenaud 9y ago
    This is what wikipedia says: A black hat hacker (or black-hat hacker) is a hacker who "violates computer security for little reason beyond maliciousness or for personal gain" The personal gain part certainly fits with short selling the stock.
    - dsacco 9y ago
      Excellent, great citation! Now, precisely what did the security researchers hack for their own gain, and precisely which computer's security was violated? If we can call them "hackers" just because they ostensibly compromised their own hardware or software as a proof of concept for the vulnerability research, does that mean that all of Google's Project Zero consists of hackers and black hats because they get paid (personal gain) by Google to find security vulnerabilities?
      - Sir_Cmpwn 9y ago
        Project Zero practices responsible disclosure. They do not make money from the exploitation of the companies whose software/hardware they find flaws in. The difference is very stark and you are being deliberately obtuse.
        dsacco 9y ago
        > They do not make money from the exploitation of the companies whose software/hardware they find flaws in. Right, and neither did these researchers. In point of fact, no, the difference really isn't all that stark. It's a difference of degree, not category. You apparently have a problem with disclosing vulnerabilities without providing advanced notice to the vendor, and you consider it especially distasteful to do so if you're financially benefitting from that. But all of that still comprises vulnerability disclosure, which is categorically different from actively using a vulnerability to compromise users as part of a criminal enterprise. We can go back and forth like this all day, because every time someone bends the definition of black hat to fit something they disagree with, I can form a counterpoint which is technically true but which no one is willing to call black hat behavior, like Google Project Zero. On the other hand, if we use the definition of black hats as criminals engaging in online fraud, augmented by security vulnerabilities, then of course Google Project Zero doesn't qualify. You're going to have a very difficult time broadening the scope of this terminology to suit your definition without accidentally including groups you don't want to be in the same bucket. And that's precisely my point. If you broaden terms too much, like "black hat" to "stuff with computers in bad faith", we can just weasel in whatever satisfies the definition or agrees with our personal viewpoint. Black hat criminals do not engage in debatable behavior, because it's strictly illegal and directly profits at the expense of other people. At best, all you can do is formulate an abstract argument about people being harmed by rapid disclosure, but that actually comes down to a debate of disclosure guidelines, not a debate of activist investing.
        Sir_Cmpwn 9y ago
        >Right, and neither did these researchers. I'm just going to conclude that you are trolling at this point and try to forget this headache of a thread.
  - Sir_Cmpwn 9y ago
    No one defined "black hat". Just what authority do you think sets that? There is none. Black hat is not a standard to which people are scrutinized.
    - dsacco 9y ago
      There is a reasonably accepted definition for what a "black hat" is. I don't particularly agree with conceptually bucketing people into black hats or white hats, but the paradigm has an existing meaning. In any case, if we go by what you're saying, then anyone can define "black hat" to mean whatever they want, which means it's a meaningless and unproductive concept to throw around in conversation. Your assertion is in a catch-22 here. Words have meaning without requiring an independent body to rigorously define them. The established definition of a black hat is someone who compromises other people using security failures for their own gain. If instead we choose to say that the term has no established definition, then the entire point is moot, because calling someone a "black hat" no longer means anything.
      - Sir_Cmpwn 9y ago
        There is a "reasonably accepted" definition of black hat, by your reasoning, and it is: someone who uses computers in bad faith.
        dsacco 9y ago
        > There is a "reasonably accepted" definition of black hat, by your reasoning, and it is: someone who uses computers in bad faith. Speaking as someone who 1) works in the security industry, 2) has managed corporate disclosure programs as an internal security engineer, 3) has run a security consulting firm working with many companies, and 4) has reported security vulnerabilities in disclosure programs; no, that's not the reasonably accepted definition. I can't think of any colleague I've ever worked with off the top of my head, nor any widely read security-focused periodical (like Krebs), who would use the term "black hat" for such a generalized disagreement of ethics.
        9y ago
lallysingh 9y ago
I think some here believe that the weapon here is financial; to trade the stock.
- dsacco 9y ago
  I'm sure they believe that, but to be blunt, that changes the definition of "black hat" from "compromising people with security vulnerabilities" to "doing things I personally find unsavory when publicly disclosing security vulnerabilities." If people want to bend over backwards to make an argument about the abstract way in which people are harmed by small disclosure windows, activist investing or information asymmetry in the market, they're free to do so. But none of those things qualifies as black hat behavior. Definitions require precision to be useful, and you throw all precision out the window if you decide to lump people with disclosure habits you dislike in with organized criminals stealing identities en masse.
hdyr 9y ago
If the term is flexible, why the hard reaction to my flexing of it? I agree with the sibling commenters here. This is a bad faith, financially-motivated disclosure with insufficient time given to AMD to react
- dsacco 9y ago
  > If the term is flexible, why the hard reaction to my flexing of it? The terminology is not flexible, it has a well established meaning. If your bar for a black hat includes legitimate security researchers disclosing vulnerabilities in a way you don't like, you've just expanded the group of people we can call "black hats" almost arbitrarily. You're putting security researchers you have a normative disagreement with into the same group of people who commit actual fraud, steal identities and sell your credit card data.
cat199 9y ago
black hats use them for bad, white hats use them for good. ideological discussions about disclosure policy aside, if they are doing this to manipulate stock prices and in doing so create a situation where more actual exploits occur, I'd say that is 'black hat' behavior.. the 'weaponization' is in the 'social engineering' of the market reaction, rather than a direct exploit in this case..
- dsacco 9y ago
  The problem with your first line is that it leaves the definition of black hat open to interpretation, when that is not how the word is actually used in the security industry or in popular reporting. Black hat activity specifically refers to criminal activity, which we can demonstrably perceive and attribute. By your reasoning, I am free to call security researchers black hats if they don't give vendors advance notice. You might disagree with that, but you can't say I'm wrong without making a normative argument about whether or not something is ultimately unethical. There is no categorical difference between me choosing to call people black hats if I disagree with their behavior and you calling these researchers black hats because they're doubling as activist investors. On the other hand, this entire sideshow is bypassed if we use the well-established definition for "black hat", which refers exclusively to illegal behavior involving security vulnerabilities and online fraud. More to the point, reporting facts is not "market manipulation" (which is also a well established term) even if you want it to be, and "social engineering" is not the same as publicizing information with the intent to move the markets. Using these words in the way you are is the same as flippantly redefining them as you go along, with the result that the conclusion is quite brittle. There could be a strong argument that the behavior is unethical, but using these terms as you are doesn't help that point along, it hampers it.
  - cat199 9y ago
    > Black hat activity specifically refers to criminal activity, which we can demonstrably perceive and attribute stock manipulation is clearly criminal, if you want to take the 'letter of the law' approach.. beyond this, this gets into the same debate as letter of the law vs spirit of the law, which has both nothing and everything to do with this topic.. black hat is not 'defined exclusively' anywhere, and of course one leaning to a 'letter of the law' argument would then also look for 'exclusive definitions' as to your point: > free to call security researchers black hats if they don't give vendors advance notice. if they are doing this for malicious purposes, yes if it is for an ideological stance, then, well, it depends on how you view their ideology. what happens if the law is incorrect? again, letter of the law vs spirit of the law. "normative argument about whether or not something is ultimately unethical" laws are normative arguments about whether or not something is ultimately unethical.. not neutral 'things' that exist in a vacuum. and they can be correct or incorrect, and also incompletely defined.. how does acting completely unethically yet entirely within the law for malicious purposes fit into your framework? Say for example, actively portscanning (legality nebulous) for already infected computers and then overcharging 2000% for cleanup? Then spamming virii from a jurisdiction where it is not illegal in order to grow this 'business'? All legal.. so it's "white hat?" or is it 'grey hat' because it is in a legal 'gray area'? I don't think that's what grey hat means either..